← Vulnerability feed

Vulnerability record · CVE-2026-94181 · published 23 September 2026

CVE-2026-94181: An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address…

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

7.4 CVSS 3.1 High EPSS 0.26% · top 84.1% CWE-451 · CWE-451 Awaiting Analysis
7.4CVSS 3.1 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
2References
24 Sep 2026Last modified by NVD

Description

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

References

LinkTags
https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-elem
https://hackerone.com/reports/3711701

Track CVE-2026-94181 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2024-43461Windows MSHTML Platform spoofing flaw enables code executionCVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML platform, the legacy rendering engine still reachable through Windows components. Th…KEVEPSS 54%analysed7.5CVE-2024-38112Microsoft Windows MSHTML Platform spoofing flaw enables code executionCVE-2024-38112 is a spoofing vulnerability in the Windows MSHTML platform affecting a broad range of Windows 10, Windows 11 and Windows Server releas…KEVEPSS 84%analysed

Source: NIST National Vulnerability Database (record CVE-2026-94181), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.